Improper sanitization of CSS values in html/template

CVE-2023-24539

What is CVE-2023-24539?

This vulnerability arises from the mishandling of angle brackets in CSS contexts, allowing for potential injection attacks. Templates using multiple actions, defined by a '/' character, can inadvertently close the CSS context, thereby enabling the execution of malformatted or unexpected HTML. This is particularly concerning when dealing with untrusted input, which could lead to security breaches or exploitation of web applications.

References